Microsoft Defender Maps MacSync Exfiltration Beyond Domains

That is useful news for Microsoft Defender for Endpoint operators because MacSync has already demonstrated why IOC-only response fails. RST Cloud documented a May 2026 C2 replacement that appeared shortly after a prior domain became public, while CIS later described a MacSync infection affecting U.S. state and local government users through a ClickFix lure. Both investigations found the same general loader pattern: a victim is persuaded to paste a command into Terminal, curl retrieves a shell-stage payload, and an AppleScript component runs through osascript.

Microsoft’s contribution is not merely a longer blocklist. It is a defensible way to separate related infrastructure from coincidental web traffic: require several endpoint and network traits to match before tagging a domain as part of the cluster. For defenders, that moves the question from “Did we contact this hostname?” to “Did a user-driven shell session retrieve a payload, invoke AppleScript, access credentials, create an archive, and upload it in chunks?”

The domain list is evidence, not the detection strategy​

The 30-plus domains Microsoft identified are worth ingesting as point-in-time indicators, particularly for retrospective searches and proxy enrichment. They should not become the sole detection control. MacSync’s operators use innocuous-looking names, rotate them rapidly, and can stand up replacement infrastructure faster than most organizations update deny lists across DNS, firewalls, EDR, and web gateways.

RST Cloud’s prior research provides the clearest warning against treating a domain as the unit of detection. Its researchers connected four confirmed C2 domains through a shared API key and identified eleven more candidates from URI patterns. The confirmed and candidate distinction matters: a matching path alone is valuable for triage, but it is weaker than a matching path combined with a recovered loader, static API key, process lineage, and matching exfiltration behavior.

Microsoft’s threshold is more disciplined. A domain was considered related when several features lined up across payload delivery, C2 check-in, and upload activity. The recurring patterns include curl using certificate-validation bypasses and quiet mode, a macOS-flavored User-Agent, an API-key request header, and parameter names such as upload_id, chunk_index, and total_chunks.

Those parameters are particularly consequential. A periodic HTTP request can be routine application traffic; a curl process launched from a suspicious shell session that creates an archive and then performs multiple HTTP PUT uploads with chunk counters is a far narrower and more meaningful signal. Microsoft’s reporting confirms that the traffic in this cluster was used for active data exfiltration, rather than only beaconing.

MacSync’s common path is a high-risk chain for developer Macs​

The observed chain starts with ClickFix, the social-engineering technique that tells users to copy and paste a command into a terminal rather than download a traditional installer. In Microsoft’s reconstruction, an interactive zsh session retrieves content through /curl/, then uses tools such as Base64 and gunzip to decode or unpack it. The payload subsequently uses osascript to blend AppleScript with shell commands including curl, cp, rm, mkdir, and killall.

That chain deserves special attention on enterprise Macs used for administration and development. The collection targets Microsoft lists go well beyond browser passwords: Keychain material, browser Safe Storage keys, SSH private keys, AWS credentials, Kubernetes configuration files, session data, browser extension storage, Apple Notes, and documents from Desktop, Documents, and Downloads are all in scope. A compromised developer endpoint can therefore become a source of cloud credentials, source-control access, production SSH keys, and browser sessions—not simply a local password-theft event.

CIS CTI independently observed the same operational sequence in a confirmed incident: a Zsh script retrieved through a /curl/ endpoint, a dynamically delivered AppleScript executed through osascript, temporary staging beneath /tmp/sync..., and an archive named /tmp/osalogging.zip. CIS reported that the archive was sent in 10 MB HTTP PUT segments and that evidence was deleted after successful exfiltration.

Microsoft’s broader domain count should not be read as proof that every MacSync operation is technically identical. Huntress, reporting on a separate MacSync intrusion in July, found a more expansive six-stage operation that included a native Mach-O remote-access component, a screen-recording helper, and trojanized wallet applications. Huntress also identified a different shared API key in that incident. The overlap in /curl/, /dynamic, AppleScript, API-gated delivery, and chunked uploads makes those behaviors strong hunting leads, but the differing infrastructure details show why defenders should avoid promoting one key or hostname into a universal family signature.

Hunt the sequence, not isolated macOS utilities​

A detection rule for curl -k, osascript, or archive creation alone will be noisy. Those tools are legitimate on many managed Macs, especially developer workstations. The practical defense is correlation across a short time window and a single user context.

Microsoft Defender for Endpoint customers should start by joining process, file, and network telemetry around the initial terminal session. Look for Terminal, zsh, or another interactive shell launching curl, followed by decoding or decompression utilities, then osascript launching shell commands or contacting the network. Escalate the event when the process tree then touches browser stores, Keychain-related files, SSH material, cloud configuration paths, or user documents.

The next high-confidence pivot is staging. Microsoft observed collection beneath /tmp/sync*, compression into /tmp/osalogging.zip, chunking, and cleanup. In a real investigation, archive creation in /tmp is not sufficient on its own; archive creation in /tmp immediately after credential-store access, followed by curl -X PUT --data-binary, is a much stronger case.

A useful initial hunting model is:

• Investigate curl requests containing /curl/, /dynamic?txd=, or /gate?buildtxd= when the initiating process is an interactive shell, osascript, or an unfamiliar script interpreter.
• Raise severity when the command line contains both -X PUT and --data-binary, while the destination URL contains upload_id, chunk_index, or total_chunks.
• Correlate outbound uploads with recent access to Keychain, Chromium or Firefox profile data, ~/.ssh, cloud credential directories, Kubernetes configuration, Apple Notes, or user document folders.
• Preserve process command lines, full URLs, proxy records, and file events before cleanup removes the archive and staging directory.

The key operational issue is telemetry retention. HTTP proxies and network sensors often retain hostnames but discard query strings, while endpoint tools may retain a process event without the complete command line. MacSync’s useful pivots sit in both places. If RemoteUrl logging omits parameters, upload_id and chunk_index will disappear; if command-line collection is suppressed, defenders lose the distinction between a normal download and a scripted PUT upload of a local archive.

Apple’s new ClickFix protections are helpful, but bypassable​

Apple has added safeguards in macOS 26.4 and later specifically aimed at malicious Terminal pastes and scripts. Apple says Terminal paste protection warns users when paste activity comes from common delivery channels such as browsers, messaging apps, or email, under conditions intended to avoid disrupting regular Terminal users. Separate XProtect-backed controls can block known malicious commands or scripts.

Those protections reduce the success rate of the initial lure, but they do not make ClickFix a solved problem. Apple’s own support guidance notes that the warning can offer a “Paste Anyway” choice when the system identifies possible malware rather than a known malicious command. The protection also depends on the user’s recent Terminal use, installed developer tooling, and the source application from which the text was copied. In other words, an organization still needs endpoint controls for cases where a user overrides a warning, uses a different terminal workflow, or encounters a payload not yet recognized by XProtect.

For Windows-centric IT teams managing mixed fleets, this is a reminder that macOS needs the same behavioral detection maturity applied to PowerShell and Windows script abuse. Terminal, zsh, curl, osascript, archive utilities, and temporary directories are not inherently malicious. The risk emerges when they form a chain that retrieves code, steals credentials, compresses local data, and sends it out in numbered HTTP PUT chunks.

What to do after a confirmed hit​

A confirmed MacSync sequence should be treated as credential compromise with possible ongoing access, not as a cleaned-up adware event. Isolate the Mac, preserve EDR and proxy telemetry, and identify every account or secret accessible from the user profile: browser sessions, Keychain items, SSH keys, cloud-provider credentials, Kubernetes configuration, saved passwords, and cryptocurrency-wallet material.

Reset and revoke exposed credentials from a separate trusted device, invalidate cloud sessions and personal access tokens, rotate SSH keys, and review cloud audit logs for use of the compromised identity. Huntress’s report of a MacSync branch with a remote-access implant and modified wallet applications adds an important containment point: removing the original shell payload may not remove everything that followed. Reimage affected systems where the full post-execution scope cannot be established.

MacSync’s domains will keep changing. The more durable response is to retain the evidence that does not: the pasted-command entry point, curl and osascript ancestry, temporary archive creation, and HTTP PUT uploads that expose the theft even after the hostname is gone.